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Abstract —This paper considers a three-receiver broadcast 
channel with degraded message sets and message cognition. The 
model consists of a common message for all three receivers, 
a private common message for only two receivers and two 
additional private messages for these two receivers, such that 
each receiver is only interested in one message, while being 
fully cognizant of the other one. First, this model is investigated 
without any secrecy constraints, where the capacity region is 
established, showing that the straightforward extension of the 
Korner and Marton inner bound to the investigated scenario is 
optimal. In particular, this agrees with Nair and Wang’s result, 
which states that the idea of indirect decoding - introduced to 
improve the Korner and Marton inner bound - does not provide a 
better region for this scenario. Further, some secrecy constraints 
are introduced by letting the private messages to be confidential 
ones. Two different secrecy criteria are considered: joint secrecy 
and individual secrecy. For both criteria, a general achievable 
rate region is provided. Moreover, the joint and individual secrecy 
capacity regions are established, if the two legitimate receivers 
are more capable than the eavesdropper. The established capacity 
regions indicate that the individual secrecy criterion can provide 
a larger capacity region as compared to the joint one, because 
each cognizant message can be used as a secret key for the 
other individual message. Further, the joint secrecy capacity is 
established for a more general class of more capable channels, 
where only one of the two legitimate receivers is more capable 
than the eavesdropper. This was done by showing that principle 
of indirect decoding introduced by Nair and El Gamal is optimal 
for this class of channels. This result is in contrast with the non¬ 
secrecy case, where the indirect decoding does not provide any 
gain. 

Index Terms —broadcast channel, degraded message sets, mes¬ 
sage cognition, joint secrecy, individual secrecy, capacity regions, 
more capable channels. 

I. Introduction 

The broadcast channel (BC) with degraded message sets 
was initially introduced by Korner and Marton in [3], They 
considered a two-receiver BC, where a common message 
is transmitted to both receivers and a private message is 
transmitted to only one of them. They established the capacity 
region for the general BC by providing a strong converse. The 
extension of Korner and Marton results to the three-receiver 
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BC with two degraded message sets has been considered 
in [4,5], where it has been shown that the straightforward 
extension of the Korner and Marton inner bound is optimal 
for many special cases. In [6], Nair and El Gamal considered 
a three-receiver BC with degraded message sets, where a 
common message is sent to all three receivers, while a private 
message is sent to only one receiver. They showed that the 
straightforward extension of the Korner and Marton inner 
bound for this scenario is no longer optimal. They presented 
a new coding scheme known as indirect decoding and showed 
that the resultant inner bound of this technique is strictly 
greater than the Korner and Marton inner bound. However, 
in [7], Nair and Wang showed that if the private message 
is to be sent to two receivers instead of one, the idea of 
indirect decoding does not yield any region better than the 
Korner and Marton inner bound. Another scenario for three- 
receiver BC with degraded message sets was considered in 
[8], where a common message is sent to all three receivers, 
while two private messages are only sent to two receivers 
with some message cognition at these receivers. In general, the 
transmission of degraded message sets over three-receiver BC 
has captured a lot of attention, yet it has not been completely 
solved as many questions remained unanswered beyond the 
two-receiver case. 

Recent work does not only consider reliable transmission, 
but it also considers more complex scenarios that involve 
certain secrecy requirements. In particular, physical layer 
security has attracted a lot of researchers nowadays, see for 
example [9-12] and references therein. Shannon was the first 
one to study the problem of secure communication from an 
information theoretic perspective in [13]. He showed that it can 
be achieved by a secret key shared between the transmitter 
and the receiver if the entropy of this key is greater than 
or equal to the entropy of the message to be transmitted. 
In [14], Wyner studied the degraded wiretap channel and 
proved that secure transmission is still achievable over a noisy 
channel without any secret key. In [15], Csiszar and Korner 
extended Wyner’s result to the general BC with common and 
confidential messages. In [16,17], the previous two approaches 
were combined by studying the availability of a shared secret 
key during secure transmission over a wiretap channel. In 
[18], Kang and Liu proved that the secrecy capacity for this 
scenario is achieved by combining the wiretap coding principle 
along with Shannon’s one-time pad idea. Over the years, the 
integration of confidential and public services over different 
channels has become very important [19], 
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Despite the tremendous effort of researchers, the extension 
of Csiszar and Korner’s work to BC with two or more 
legitimate receivers has remained an open topic. In [20], Chia 
and El Gamal investigated the transmission of one common 
and one confidential message over a BC with two legitimate 
receivers and one eavesdropper. They derived a general achiev¬ 
able rate region and established the secrecy capacity if the 
two legitimate receivers are less noisy than the eavesdropper. 
They also showed that in some cases the indirect decoding can 
provide an inner bound that is strictly larger than the direct 
extension of Csiszar and Korner’s approach. 

In this paper we investigate the transmission of degraded 
message sets with two layers over a three-receiver BC under 
different secrecy constraints. Our model combines the scenar¬ 
ios in [7,8,20] as follows: a common message is transmitted to 
all three receivers, a confidential common message to the two 
legitimate receivers and two confidential individual messages 
to the two legitimate receivers, where each receiver is only 
interested in one them, while being fully cognizant of the other 
one. This problem is of high interest and importance because 
it does not only generalize and combine the previous works 
in [7,8,20], but it is also of practical relevance since it can be 
motivated by the concept of two-phase bidirectional relaying 
in a three-node network [21,22], 

In the first phase of the bidirectional relaying, node 1 
and node 2 transmit their messages to the relay node which 
decodes them, while keeping the eavesdropper unable to 
intercept any information about the transmission. This phase 
corresponds to the multiple access wiretap channel and was 
investigated in [23-25], where the latter discusses different se¬ 
crecy criteria. Our work is related to the succeeding broadcast 
phase, where the relay re-encodes and transmits these mes¬ 
sages back to the intended nodes. Since the receiving nodes 
are cognizant of their own message from the previous phase, 
they can use it as an additional side information for decoding. 
First results for the case where this communication scenario 
must be protected against an additional eavesdropper appeared 
in [26], where different achievable rate regions and an outer 
bound were provided. In our problem, we have an additional 
feature as the relay transmits another common confidential 
message to both legitimate receivers and a common message 
for all three nodes. 

In [26], the authors claimed to define the secrecy re¬ 
quirement of their model based on a conservative secrecy 
measure known as joint secrecy. This measure assures the 
secrecy of each confidential message even if the other one is 
compromised. However, they established an achievable region 
in [26, Theorem 1] using secret key approach, where the 
confidential message of one user is used as a secret key 
for the other one. One can show that this encoding scheme 
does not fulfill the joint secrecy constraint. This observation 
encouraged us to consider another secrecy constraint, in which 
the legitimate receivers can cooperate together to protect their 
confidential messages based on some form of mutual trust. 
This led to the less conservative secrecy measure known as 
individual secrecy. In [1,2], we investigated the effect of 
relaxing the secrecy constraint from joint secrecy to individual 
secrecy on the capacity region of the BC with receiver side 


information. On the other hand, different individual secrecy 
coding techniques has been introduced in an early parallel and 
independent work in [27] and more recently in [28-30]. 

The rest of this paper is organized as follows. In Section II, 
we introduce the model of three-receiver BC with degraded 
message sets and full message cognition without any secrecy 
constraints. We provide a weak converse showing that the 
straightforward extension of the Korner and Marton inner- 
bound is in fact the capacity region. This result agrees with 
the one in [7], that for this case indirect decoding can not 
outperform the Korner and Marton inner bound. In Section III, 
we introduce secrecy constraints to our model and discuss the 
differences between the joint and individual secrecy criteria. In 
Section IV, we provide an achievable rate region for the joint 
secrecy criterion. We then establish the joint secrecy capacity 
region if only one of the legitimate receivers is more capable 
than the eavesdropper using the principle of indirect decoding. 
In Section V, we provide an achievable rate region for the 
individual secrecy criterion. We then establish the individual 
secrecy capacity region if the two legitimate receivers are more 
capable than the eavesdropper. 

Notation 

In this paper, random variables are denoted by capital letters 
and their realizations by the corresponding lower case letters, 
while calligraphic letters are used to denote sets. X" denotes 
the sequence of variables (Xi,... ,X n ), where X,; is the i th 
variable in the sequence. Additionally, we use X' to denote 
the sequence (X, ; ,... ,X„). A probability distribution for the 
random variable X is denoted by Q{x). U — V — X denotes 
a Markov chain of random variable U, V and X in this order, 
while (U — V, K) — X — Y implies that U — V — X — Y and 
K — X — Y are Markov chains. M + is used to denote the set 
of nonnegative real numbers. H(-) and !(•;•) are the traditional 
entropy and mutual information. The probability of an event is 
given by P[-], while E[-] is used to represent the expectation. 
Moreover, [a, 6] is used to represent the set of natural numbers 
between a and b. 

II. BC with Degraded Message Sets and Message 
Cognition 

In this section, we investigate the three-receiver BC with 
degraded message sets and message cognition without any se¬ 
crecy constraints. First, we introduce our model, then establish 
the capacity region for the general three-receiver BC with two 
degraded message sets. 

A. System Model and Channel Comparison 

Fet X , y i, y 2 and Z be finite input and output sets. Then 
for input and output sequences x n £ X n , y™ £ y™, y 2 £ y 2 
and z n £ Z" of length n, the discrete memoryless BC is given 

by 

n 

Q n {yi,y?,z n \x n ) = Q{yi k ,yi k ,z k \x k ), 

fc=i 

where x n represents the transmitted sequence, y", y 2 and z n 
represent the received sequence at the three receivers. Before 
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we discuss our model in details, we need to introduce two 
important classes of BCs, that we will address a lot in our 
investigation. 


that maps each channel observation at the respective receiver 
and the cognizant message to the corresponding intended 
messages or an error message {?}. 


Definition 1. In a discrete memoryless BC Q(y, z\x), Y is 
said to be less noisy than Z, also written as Y Y Z, if for 
every random variable V such that V — X — (Y, Z) forms a 
Markov chain, we have 


We assume that the messages M c , M 0 , and M 2 are 
independent and chosen uniformly at random. The reliability 
performance of C n is measured in terms of its average prob¬ 
ability of error 


I(V;Y) >I(V;Z). (1) 

On the other hand, Y is said to be more capable than Z, if 
for every input distribution on X, we have 


P e {C n ) ip[(M c ,M 0l M 1 ) ^ (McMo.Mj) or 

(M c ,M 0 ,M 2 ) ^ (M c ,M 0 ,M 2 ) or M c ^ M c 


(3) 


I(X;Y) >I(X;Z). (2) 

The class of more capable channels is strictly wider than 
the less noisy one. It can be shown that any less noisy channel 
is a more capable one. Further, it was shown that the class of 
less noisy channels contains the physically and stochastically 
degraded channels [31], 

We consider the standard model with a block code of arbi¬ 
trary but fixed length n. We consider four different messages 
sets. The first set contains the common messages for all three 
receivers and is denoted by M c = [1, 2" flc ]. The second set is 
denoted by Mo = [[1, 2 n ' Rn ]| and contains the private common 
messages for Receivers 1 and 2. While the last two sets 
contain the individual private messages Mi = [l,2 n - Rl ] and 
M 2 = [1, 2 nR2 J. Further, we assume full message cognition 
at Yi and Y 2 1 , such that Yi is cognizant of the entire message 
M 2 and Y 2 of the entire message Mi as shown in Fig. 1. 



Fig. 1. Three-receiver broadcast channel with degraded message sets and 
message cognition. 

Remark 1. If we let Mi = M 2 = 0 , our model reduces to 
the three-receiver BC with two degraded message sets studied 
in [6, 7]. 

Definition 2. A {2 nR %2 nR \2 nR \2 nR fn) code C n for the 
BC with degraded message sets and message cognition con¬ 
sists of: four independent message sets M c , Mo, Mi and 
M 2 ; an encoding function at the transmitter 

E : M c x Mo x Mi x M 2 —t X n 

which maps a message quadruple (rn c , mo , ?tt-i , m 2 ) £ M c X 
Mo X M i x M 2 to a codeword x n (m c ,mo,mi,m 2 ); and 
three decoders, one at each receiver 

<pi : V" x M 2 -> M c x M 0 x Mi U {?} 
ip 2 ■■ y 2 X Ml -> Me x Mo x M 2 U {?} 

Po :Z n ^M c U{7} 

'From this point, we will refer to different receivers by their respective 
channel outputs interchangeably. 


where (M c ,MojMi), (M c ,M 0 ,M 2 ) and M c are the estimated 
messages at Yi, Y 2 and Z respectively. 

Definition 3. A rate quadruple (R c , Rq, Ri, R 2 ) £ R+ 
is achievable for the BC with degraded message sets 
and message cognition, if there exists a sequence of 
(2 nRc , 2 nR °, 2 nRl , 2 nR2 , n) codes C n and a sequence e n , such 
that for n is large enough, the following holds 

P e (C n ) < e n and lim e n = 0. (4) 

n—fo o 


B. Capacity Region 

Theorem 1. The capacity region of the three-receiver BC with 
degraded message sets and message cognition is the set of all 
rate quadruples (R c , Rq, Ri, R 2 ) £ that satisfy 

R c < I(U; Z) 

Ro + Ri < I(X; Y x |U) 

R 0 + R 2 <I(X;Y 2 |U) 

R c + i?o + Ri f Yi) 

R c + Ro + R2 <I(X;Y 2 ) (5) 

for some (U,X), such that U —X—(Yi,Y 2 ,Z) forms a 
Markov chain. Further it suffices to have \U\ < \X\ + 2. 

Proof: The achievability follows directly from the 
straightforward extension of the Korner and Marton inner 
bound in [3] to the three-receiver BC with degraded message 
sets and message cognition as in [7, 8]. Superposition encoding 
is used as follows: m c is encoded in the cloud centers 
codewords U”, while (mo,mi,m 2 ) are superimposed in the 
satellite codewords X ". Joint typicality decoders are then used 
at each receiver leading to the bounds in (5). 

For the converse, we start by establishing the reliability 
upper bounds for any achievable rates. Based on Fano’s 
inequality, the expression of the average error probability in 
(3) and the reliability constraint given by (4), we have 

H(M c |Z n ),H(M c |Y”M 2 ),H(M c |YJM 1 ) < n 7c (e n ) (6) 

H(MoM! |Y”M 2 M c ) < n 7 i (e n ) (7) 

H(MoM 2 |Y”M!M c ) < n 72 (e n ) (8) 

where 7c (e„) = 1/n + e n R c , 7 i(e n ) = 1/n + e n (Ro + Ri) 
and y 2 (e n ) = 1/n + e n (Ro + R 2 ). 

Next, we let U 4 = (M c ,Z i+1 ), K j = Y®" 1 , K? = Y*" 1 , 
M 4 (M 0 , M 1? M 2 ), V, 4 (M, U,), V j 4 (V<,KJ) and Vf 4 
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(V<,K?). We then start by considering the common rate R c . 
Using Eq. (6), we have 

R c < ~ [h(M c ) - H(M C |Z")1 + 7 c (e n ) 
n L J 

= —I(M C ; Z") + 7 c (e n ) 
n 

1 n 

= - Vl(M c ;Z t |Z J+1 )+ 7c (e„) 

n ' 

2=1 

1 n 

< - Vl(M c Z i+1 ;Z,)+ 7c (6 n ) 

n r-f 
2=1 

1 n 

= — I(Ui; Zi) + 7c( e n)- (9) 

n 

i=i 

Next, we consider the sum of the private rates (Ro + Ri) 
which are intended for receiver Yi. We have 

Ro + Ri < -I(M 0 M i; Y^|M 2 M c ) + 7l (e„) 

n 

(&) I r i 

< - I(M;Y”|M c )+I(M;Z n |M c )-I(M;Z”|M c ) 
n L J 

+ 7i(e n ) 

= ~E [n( M ; Y ijl M c Y i _1 ) + i( M ; zjM c z i+1 ) 

4 2= 1 

-I(M; ZJM c Z i+1 )] + 7 i(e n ) 

1 n 

= -X! kM;Y li |M c Yi- 1 Z i + 1 )+I(M;Z i |M c Z i+1 ) 

Tl . L 
i=l 

— I(M; ZJMcYU'Z* -1 " 1 )] + 7 i(e„) 

1 71 

= - E [l(Vj; YulUiKj) - I(Vj; Z^K 1 ) 

n z ' L 

2=1 

+ I(V j ;Z i |U i )] +li{e n ), (10) 

where (a) follows from (7); (6) follows as I(M;Y) ! |M C ) > 
I(MoMi; Y”|M 2 M C ) and (c) follows by the Csiszar sum 
identity [15, Lemma 7], If we use Eq. (8) and follow the exact 
same steps, we can derive a similar bound for the sum of the 
private rates (i?o + lh) intended for receiver Y 2 as follows: 

1 72 

Ro + R2 < -V kv^YwIUiK?) 

n z ' L 

2=1 

+ I(V i ;Z i |U i )] +72(£n). (11) 

Now using (9), (10) and (11) followed by introduc¬ 
ing a time sharing random variable T independent of 

all others and uniformly distributed over [l;n], and let 
U = (U T , T), K 1 = K*,, K 2 = K 2 ,, V = V T , V 1 = V^, 
V 2 = V|, Yi = Yit, Y 2 = Y 2T and Z = Z T , then take the 
limit as n — > oo such that, 7 c (e n )j 7 i(en) an d 72 (e n ) 0, 
we reach the following 

R c < I(U;Z) (12a) 

Ro + Ri < I(V 1 ; Y 1 IUK 1 ) — I(V 1 ; ZIUK 1 ) + I(V; Z|U) 

(12b) 


Ro + R 2 < I(V 2 ; Y 2 |UK 2 ) - I(V 2 ; Z|UK 2 ) + I(V; Z|U), 

(12c) 

where (U-V, K 1 )-V 1 -X-(Y 1 , Y 2 , Z } and (U-V,K 2 )-V 2 
—X—(Yi,Y 2 ,Z) form Markov chains. Since the conditional 
mutual information is the expectation of the unconditional one, 
Eq. (12b) can be further upper-bounded as follows: 

R 0 +R 1 < Ek 1 IfV 1 ; Y 1 IUK 1 )—ICV 1 ; ZlUK 1 ) +I(V;Z|U) 

I(V 1 ; Yi|U, K 1 = fc 1 *)—E^ 1 ; Z|U, K 1 = k 1 *) 

+ I(V;Z|U) 

= ^V 1 *; Yi|U) - ^V 1 *; Z|U) + I(V; Z|U) (13) 

where (a) follows as k 1 * is the value of K 1 that maximizes 
the difference I^V 1 ; Yi|U, K 1 = fc 1 )—^V 1 ; Z|U, K 1 = fc 1 ); 
while (b) follows because V 1 * is distributed according to 
the following probability distribution <5(u 1 |u, k 1 = k 1 *) [11, 
Corollary 2.3]. This implies that the right hand side of Eq. 
(12b) is maximized by setting K 1 = k 1 *. Using this result, 
we can upper-bound Eq. (12b) as follows: 

R 0 + Ri < I(V 1 ; Y 1 |UK 1 ) - ^V 1 ; ZlUK 1 ) + I(V; Z|U) 

=■* IfV 1 ; Y 1 IUK 1 ) + I(K 1 ; Z|U) — I(K 1 ; Z|V) 

(b) 

< ICV 1 ;YilUjK 1 =k 1 *)+I{K 1 = U*;Z|U) 

-^K 1 = fc 1 *; Z|V) 

= I(V 1 *; YilU) 

(d) 

< I(X;Yi|U), (14) 

where (a) follows by the mutual information chain rule; 
(6) follows because setting K 1 = k 1 * maximizes the right 
hand side of Eq. (12b); (c) follows because I(A: 1 *;Z|U) and 
I(fc 1 *;Z|V) vanish for a fixed realization of K 1 = fc 1 *; while 
(d) follows from the data processing inequality and the fact 
that U — V 1 * — X— (Yi, Y 2 , Z) forms a Markov chain, which 
implies that ^V 1 *; Yi|U) < I(X; Yi|U). 

Now, If we apply the same steps and ideas to Eq. (12c), we 
can derive the following bound: 

Ro + R 2 <I(V 2 *;Y 2 |U) 

<I(X;Y 2 |U), (15) 

where U — V 2 * — X — (Yi, Y 2 , Z) forms a Markov chain and 
V 2 * is distributed as Q(y 2 \u, k 2 = k 2 *) such that, k 2 * is the 
value of K 2 that maximizes the difference I(V 2 ; Y 2 |U, K 2 = 
k 2 ) — I(V 2 ; Z|U, K 2 = k 2 ). At this point we need to illustrate 
an important fact. One might argue that getting rid of the 
two conditional random variables K 1 and K 2 as we did, can 
not be done simultaneously because K 1 and K 2 might be 
dependent, such that the maximizing values k 1 * and k 2 * can 
not occur concurrently. However, this argument does not affect 
our converse because it only implies that the derived upper 
bounds might not be as tight as the original ones. To finalize 
our converse, we need to highlight the standard upper bounds 
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for reliable transmission 

R c + Ro + R\ ^ I(X; Yg) 

R c + R 0 + R 2 <1{X;Y 2 ). (16) 

Now, if we combine (12a), along with (14), (15) and (16), 
such that U — X— (Y 1 ,Y 2 ,Z) forms a Markov chain, we 
reach the same region given by (5). In order to complete our 
converse, we need to point out that the cardinality argument 
\U\ < X +2 follows from the Fenchel-Bunt strengthening of 
the usual Caratheodory’s theorem [31, Appendix C], ■ 

Remark 2. It is important to note that, Theorem 1 implies 
that the inner bound established in [7] is in fact the capacity 
region. 

III. Secrecy in BC with Degraded Message Sets 
and Message Cognition 

In this section, we will investigate the three-receiver BC 
with degraded message sets and message cognition under 
two different secrecy constraints: joint secrecy and individual 
secrecy. We compare these two criteria by investigating their 
capacity regions for some special cases and show that the 
individual secrecy provides a larger secrecy capacity compared 
to the joint one. 

A. Secrecy Model and Criteria 

We start by modifying the model introduced in the previous 
section, such that the private messages Mo,M;l and M 2 are 
now confidential messages that need to be kept secret from the 
eavesdropper as shown in Figure 2. Our new code is defined 
as follows: 



Fig. 2. Wiretap broadcast channel with degraded message sets and message 
cognition 

Definition 4. A (2 nR %2 nR \2 nR \2 nR fn) code C s n for the 
wiretap BC with degraded message sets and message cognition 
consists of: four independent message sets M c , Mo, Mi and 
Mi: a source of local randomness at the encoder IZ which 
is distributed according to Q(r); an encoding function at the 
relay node 

E : M c x Mo x Mi x Mi x R -a X n 

which maps a common message m c € M c , a confidential 
message triple (mo,rrii,m 2 ) € Mo x Mi x Mi and a 
realization of the local randomness r £ TZ to a codeword 
x n (m c . Too, mi, mi, r), and three decoders, one for each node 

<pi : yf x Mi -A M c x Mo x Mi U {?} 
c pi : y% X Ml —> Me x Mo x Mi U {?} 
y>3 : ->• M c U {?} 


that maps each channel observation at the respective node and 
the cognizant message to the corresponding required messages 
or an error message {?}. 

We assume that the messages M c , M 0 , Mi and M 2 are 
chosen uniformly at random and use the average error prob¬ 
ability in (3) to measure the reliability performance of the 
code Cf. On the other hand, the secrecy performance of C* 
is measured with respect to two different criteria. These two 
criteria identify the level of ignorance of the eavesdropper 2 
about the confidential messages Mo, Mi and M 2 as follows: 

1. Joint Secrecy: This criterion requires the leakage of the 
confidential messages of one user to the eavesdropper given 
the individual message of the other user to be small. For our 
model, this requirement can be expressed as follows: 

I(MoM i; Z"|M 2 ) < Tin and I(M 0 M 2 ; Z n \Mi) < r 2n , 
where lim Ti„,r 2n = 0. (17) 

n—foo 

This criterion guarantees that the rate of information leaked 
to the eavesdropper from one user is small even if the other 
individual transmitted message is compromised. Thus, in this 
scenario the legitimate receivers do not have to trust each other. 
In some literature, the joint secrecy criterion is defined such 
that, the mutual leakage of all confidential messages to the 
eavesdropper is small as follows: 

I(MoMiM 2 ;Z") < r n and lim r„ = 0. (18) 

n—fo o 

One can easily show that the definition in (17) is equivalent 
to the one in (18) for some r„ as follows: 

I(M 0 M 1 M 2 ; Z n ) = I(M 0 Mi; Z n |M 2 ) + I(M 2 ; Z n ) 

(a) 

< I(MoM 1 ;Z n |M 2 ) +I(M 2 ;Z"|M 1 ) 

(b) 

< I(M 0 Mi;Z n |M 2 )+I(M 0 M 2 ;Z n |M 1 ) 

5; Ti n ~b t~2n — T n , 

where (a) follows because Mi and M 2 are independent which 
implies that I(M 2 ; Z n ) < I(M 2 ; Z"|Mi); while (b) follows be¬ 
cause I(M 2 ;Z"|Mi) < I(MoM 2 ; Z"|Mi). On the other hand, 
if Eq. (18) holds, it follows directly that E(M 0 M 1 ; Z"|M 2 ) < 
T n and E(MqM 2 ; Z”|M!) < r n . However, we prefer the 
definition in (17), because it provides a better understanding 
to the relation between the legitimate receivers and allows 
us to interpret the immunity of the joint secrecy against 
compromised receivers. 

2. Individual Secrecy: This criterion requires the leakage 
of the confidential messages of each user to the eavesdropper 
to be small without conditioning on the confidential messages 
of the others users. This requirement can be formulated as 
follows: 

I(M 0 M i; Z") <Tm and I(M 0 M 2 ; Z") < r 2 „, (19) 

where T\ n and r 2n are defined as before. Differently from the 
conservative constraint in (17), where different users do not 

-Although the third receiver (Z) is part of our model and not an external 
user, we will refer to it in the rest of the paper as an eavesdropper. 
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trust each other, this secrecy measure allows the legitimate 
receivers to cooperate in protecting their messages against 
eavesdropping. In some literatures the individual secrecy cri¬ 
terion requires the sum of the leakages of each confidential 
message to the eavesdropper to be small as: 

I(M 0 ; Z n ) + I(M i; Z") + I(M 2 ; Z") < r„. (20) 

However, this definition is only equivalent to the one in (19) 
if Mo = 0, but in general they are not the same. In fact, the 
constraint in (19) is stronger than this one. This is because 
Eq. (19) directly implies Eq. (20), while the opposite is not 
correct. The difference between these two definitions is in the 
interpretation of the word individual. In (19), individuality 
means different transmission flows, while in (20) it means 
different confidential messages. In this paper, we will use the 
individual secrecy constraint given in (19) because it implies 
the other constraint in (20) and we think it is more convenient 
and meaningful. 

Definition 5. A rate quadruple (R c , R 0 , Ri, R 2 ) £ K 1 
is achievable for the wiretap BC with degraded message 
sets and message cognition, if there exist a sequence of 
(2 nR °, 2 nR °, 2 nRl , 2 nR2 , n) codes C* and three sequences 
e„, T\ n , t 2 n , where n is large enough, such that 

Pe{C n ) < e„, lim e„,Ti„,T 2 „ = 0. (21) 

n—foo 

and depending on the selected secrecy criterion, the conditions 
in (17) or (19) are fulfilled. 

Remark 3. It is worth mentioning that the previous definition 
and the requirements of the joint and individual secrecy 
criteria use the notation of strong secrecy [32,33], where the 
intuition is to have the total amount of information leaked to 
the eavesdropper to be small. 

Remark 4. It is important to note how our model generalize 
different works on the wiretap BC with more than one legiti¬ 
mate receiver as follows: 

• If we let Mi = M 2 = 0, our model reduces to the 
three receivers BC with common and confidential messages 
investigated in [20], 

• If we let M c = Mq = 0, our model reduces to the 
wiretap BC with receiver side information. This channel was 
investigated under the joint secrecy constraint in [1,26] and 
under the individual secrecy constraint in [1, 27], 

B. Individual Secrecy in Shannon’s Ciphering System 

In this subsection, we will use Shannon’s ciphering system 
to show why addressing individual secrecy with respect to 
different messages might be misleading, and that it is more 
consistent to interpret individuality with respect to different 
transmission flows. We consider the scenario given by Fig¬ 
ure 3. Shannon studied this model under the following secrecy 
constraint: 

I(M; X) = 0. (22) 

He proved that this requirement is achieved if H(M)<H(K), 
where K is the secret key shared between the transmit¬ 
ter and the receiver. In practical, it is hard to fulfill this 


- ® - 

M , --s X ( --s M 

——— ,, H Encoder --H Decoder -----*- 

Mi,M2 J (J Mi,M2 

CZ “ 'i M Secret 

-H Eavesdropper-► 

l___J Mi, M 2 Secret 

Fig. 3. Shannon’s Cipher System 


condition because secret keys are usually shorter than the 
message. Now assume that we have a secret key such that 
H(K) = |H(M). We can construct the following coding strat¬ 
egy. First, we divide M into two messages Mj and M 2 , 
such that H(Mi) = H(M 2 ) = H(K). We then construct a new 
secret key K by concatenating K and Mi. Now the encoder 
outputs X = M ® K, which is equivalent to the concatenation 
of Mi (gi K and M 2 0 Mi. The decoder works in the following 
order, it first extracts Mi from the first part of X by Xoring 
it with the shared secret key K, then it use Mi to extract M 2 
from the second part of X. 

Using this technique, we can overcome the problem of short 
secret key, however we need to understand the drawbacks of 
such technique. Aside form the problem of error progression 
that arises form using the estimated Mi to decode M 2 , 
this technique does not fulfill the secrecy constraint in (22). 
However, it fulfill the following individual secrecy constraint: 

I(Mi;X)+I(M 2 ;X)=0. (23) 

In general, we can extend this coding technique for short 
keys with smaller entropy by dividing the message M into 
smaller messages of the same entropy as the given key as 
M = nf = i Mi. We can show that, the previous technique 
grants a certain secrecy level such that, the sum of the leakage 
of the small messages to the eavesdropper is small. 

The difference between the two secrecy measures in the 
previous example is related to how to address the secrecy of 
information transmitted to a single user; whether it should be 
protected as a one big entity or it can be divided into smaller 
parts, where each part is protected separately. This issue is 
identical to the problem of identifying the individual secrecy 
and whether individuality means different users or different 
messages. That is why, we preferred the individual secrecy 
constraint in (19) because it requires the whole information 
transmitted to a certain user to be protected as one big entity. In 
our opinion, this is a more consistent and meaningful notation. 

C. Secrecy Capacity Regions: Joint Vi Individual 

In this subsection, we will try to highlight the differences 
between the joint and the individual secrecy criteria. To do so, 
we will compare the secrecy capacity region of both criteria 
for some special cases. Before we discuss these results, we 
need to introduce the following lemma. 

Lemma 1. Let (fly. z\x) be a discrete memoryless BC and 
assume that Y is less noisy than Z. Consider two independent 
random variables M and W, such that (M, W) — X n — 
(Y™,Z n ) forms a Markov chain. Then the following holds: 
I(M;Y”|W) > I(M;Z n |W). 
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Proof: The proof uses a combination of standard tech¬ 
niques from [11,15] and is given in Appendix A for com¬ 
pleteness. ■ 


In the first scenario, we consider a class of less noisy 
wiretap BC as in Figure 2, where the eavesdropper is less 
noisy than the two legitimate receivers. We also modify the 
model such that, we only have the two individual confidential 
messages Mi and M 2 , without the common message M c 
and the common confidential message Mo. Thus, the joint 
secrecy conditions in (17) change to I(Mi; Z"|M 2 ) < T\ n and 
I(M 2 ;Z n |Mi) < r 2ra , while the individual secrecy conditions 
in (19) change to H^M^ Z n ) < r ln and I(M 2 ; Z ra ) < r 2n . 


Theorem 2. Consider a wiretap BC with message cognition, 
where the eavesdropper Z is less noisy than the two legitimate 
receivers Yi and Y 2 , i.e. Z A Yi and Z A Y 2 . Then the joint 
secrecy capacity region is empty, while the individual secrecy 
capacity region is given by the set of all rate pairs (R\, R 2 ) € 
R+ that satisfy 


Ri = R 2 < min 


I(X;Y 1 ),I(X;Y 2 ) 


(24) 


Proof: We start with the individual secrecy capacity 
region. The proof of the achievability is based on interpreting 
each individual message as a secret key for the other one. 
The encoder constructs the Xored message M® by Xoring the 
corresponding elements of Mi and M 2 as follows: 


(1 + T n )/n + e n R\\ (c) follows from Lemma 1 because Z A 
Yi, which implies that I(MiM 2 ;Y”) — I(MiM 2 ;Z") < 0 
and ( d ) follows because R 2 > l/nI(M 2 ; Z^M^. If we let 
72(e n ,T2n) = (1 + T 2rl )/n + e n R 2 and follow the same steps 
we can derive a similar bound for R 2 as follows: 


R 2 < Ri + 7 2 {e n , T 2n ). (26) 

Now in order to finalize our converse we need to highlight 
the standard upper bound for reliable transmission for each 
receiver given by: 

Ri < I(X; Yi) and f ? 2 < I(X; Y 2 ). (27) 


Finally, if we take the limit as n —> 00 for (25), (26), such that 
7 i(e n , r„) and 7 2 (e n , r„) —> 0, Our converse for the individual 
secrecy capacity region in (24) is complete. 

Now, we turn to the other half of the theorem that indicates 
that the joint secrecy capacity region is empty if the eaves¬ 
dropper is less noisy than the two legitimate receivers. The 
proof is based on Lemma 1 and is a direct consequence of 
[10, Proposition 3.4] and [15] as follows: 


Ri < —I(M i; Y™|M 2 ) + 7 t(e rl ) 
n 

(b) 1 r 

< - I(M i; Y”|M 2 ) — I(M X ; Z”|M 2 ) 
n L 


(c) 

< 7i(e„,r n ). 


7i (£n,r n ) 


(28) 


to® = mi <g>m 2 . 

In order to transmit a message pair (m,-\, m 2 ), the encoder 
generates the sequence X”(m®), then transmits it to both 
receivers. The problem simplifies to a multicast problem and 
reliable transmission is only guaranteed by the condition in 
(24). Each legitimate receiver decodes the Xored message M® 
then uses the side information to extract it is own message. 
On the other hand, the eavesdropper can not extract any 
information about Mi and M 2 , although it can correctly 
decode M®, because I(M®,M!) = 0 and I(M®.M 2 ) = 0. 

Now for the converse, using Lemma 1, we will show that, if 
Z is less noisy than both Yi and Y 2 , the two rates If and R 2 
are equal. Let e n and r n = max(ri n ,T 2n ) be two sequences, 
such that as n -> 00 , e„ and r„ —> 0 , we have 

Ri < —I(M i; Y"|M 2 ) + 7 i(e„) 
n 

< -E(M 1 M 2 ; Y")+7!(e„) 
n 


1 

n 

I(MiM 2 ;Y") -I(Mi;Z") 

+ 7 i(e n ,r„) 

1 

n 

I(M!M 2 ;Y”) -I(M!M 2 ;Z n ) +I(M 2 ;Z"|M 1 ) 

+ 7l(en,T„) 


-I(M 2 ;Z”|Mi) + 7 i(e n ,r n ) 
n 



< f ? 2 + r yi{e n ,r n ), (25) 

where (a) follows from Fano’s inequality as 71 (e„) = l/n + 
e n Ri, ( b) follows from (19), when M 0 = 0 and 7 i(e„,r n ) = 


where (a) follows from Fano’s inequality; ( 6 ) follows from 
(17), for Mo = 0; while (c) follows from Lemma 1 because 
Z A Yi, which implies that I(Mi;Y"|M 2 ) < I(Mi; Z fl |M 2 ). 
Similarly, we have for R- 2 the following 

R 2 < 72 (en,r n ). (29) 

Now if we take the limit as n —> 00 for (28), (29), such that 
71 (en,T n ) and 7 2 (e n ,r n ) 0, we have R ± = R 2 = 0. This 

implies that the joint secrecy capacity region for this scenario 
is empty. ■ 

Remark 5. The previous result was established for wiretap BC 
with receiver side information, where the legitimate receivers 
Yi and Y 2 are degraded from the eavesdropper Z in [28], 

In the next scenario, we will continue with the previous 
model, where we discuss the wiretap BC in Figure 2 with only 
Mi and M 2 . However, we will investigate a different class of 
less noisy channels, where the two legitimate receivers Yi and 
Y 2 are less noisy than the eavesdropper Z. 

Theorem 3. Consider a wiretap BC with message cognition, 
where the two legitimate receivers Yi and Y 2 are less noisy 
than the eavesdropper Z, i.e. Yi 7 Z and Y 2 A Z. Then the 
joint secrecy capacity region is given by the set of all rate 
pairs (f?i,i? 2 ) G R+, such that 

7? 1 <I(X;Y 1 )-I(X;Z) 
f ? 2 <I(X;Y 2 )-I(X;Z). 

While, the individual secrecy capacity region for the same 
scenario is given by the set of all rate pairs (Ri,R 2 ) £ 
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that satisfy 


following lower bounds: 


f?i < min |l(X; Yi) - I(X; Z ) + R 2 , I(X; Yi) 
R 2 < min |"l(X; Y 2 ) - I(X; Z ) + R ± , I(X; Y 2 ) 


(31) 


R c < min |l(U; Yi), I(U; Y 2 ), I(U; Z) 

Ro <I(V;Yi\V) 

Ro <I(V;Y 2 |U)-I(V;Z|U). 


(33) 


Remark 6. Since the class of less noisy channels includes 
the class of physically and stochastically degraded channels, 
the previous theorem generalizes the secrecy capacity regions 
established in [28], for the wiretap BC with message cognition, 
where the eavesdropper is degraded from both legitimate 
receivers. 


Since Yi >; Y 2 , which implies that I(U;Y 2 ) < I(U;Yi) and 
I(V;Y 2 |U) < I(V; Yi|U). Substituting these two relations in 
(33) leads the achievability of the region in (32). On the 
other hand, the converse follows directly using the standard 
techniques in [15, Theorem 1], ■ 

D. Discussion 


Proof: We will only give a sketch for the ideas of the 
proof as we will present a detailed proof in the next sections 
for a more general case. The achievability of the joint secrecy 
region follows from technique of random coding with product 
structure as in [15], while the achievability of the individual 
secrecy region combines the techniques of wiretap random 
coding along with Shannon’s one time pad cipher system used 
in Theorem 2, where the ciphered message is used as a part 
of the randomization index needed for the wiretap random 
coding. This encoding scheme was first introduced in [27]. 
On the other hand, the converse for the joint secrecy region 
follows using the standard techniques and procedures used 
in [20] for less noisy channels. While the converse for the 
individual secrecy region follows by adapting those techniques 
to the individual secrecy constraint. ■ 

Differently from the previous two scenarios, where the joint 
and the individual secrecy criteria lead to different capacity 
regions, in the next example, we will investigate a scenario 
where the two secrecy criteria are equivalent. Consider a 
wiretap BC as in Figure 2, where we only have the common 
message M c and the common confidential message Mo. One 
can easily conclude by comparing the requirements of the 
joint secrecy and the individual secrecy in (17) and (19) when 
Mi = M 2 = 0, that the two secrecy criteria are the same. 
Again, we will focus on a class of less noisy channels, where 
one of the legitimate receivers is less noisy than the other one, 
while the relation to the eavesdropper is arbitrary. 

Theorem 4. The joint and individual secrecy capacity region 
for the wiretap BC with a common message and one confiden¬ 
tial message, if one of the legitimate receivers is less noisy than 
the other one (Yi A Y 2 ), is the set of all rates (i? c , Ro) £ R+ 
that satisfy 


R c min 


I(U;Y 2 ),I(U;Z) 


Ro <I(V;Y 2 |U)-I(V;Z|U) 


(32) 


for some (U, V, X), such that U — V — X — (Y 1; Y 2 , Z) forms 
a Markov chain. Further it suffices to have \IA\ < | X\ + 3 and 
|V| < |Y| 2 +4|Y|+3. 

Proof: The achievability follows from the straightforward 
extension of the Csiszar-Korner results in [15], leading to the 


The previous examples are very helpful in understanding the 
differences between the joint and individual secrecy criteria. 
They also helps in capturing the advantages and disadvantages 
of each one. This can be summarized in the following points: 

1. Any code that satisfies the joint secrecy criterion will also 
satisfy the individual one as well. This advocates the fact that 
the individual secrecy is a less conservative secrecy measure 
as compared to the joint one. 

2. The individual secrecy criterion provides a larger capacity 
region as compared to the joint one. Even if the joint capacity 
region is zero, the individual criterion can provide an non 
vanishing achievable rate. This increase in the rate comes 
from the usage of secret key encoding in addition to the 
standard random wiretap encoding. That is why the value 
of this increase is directly proportional with the size of the 
individual messages cf. (30) and (31). 

3. The joint secrecy criterion is a very conservative secrecy 
measure. Even if one of the confidential messages is revealed 
to the eavesdropper in a genie-aided way, the other message 
is still protected as follows: 

I(M i; Z n M 2 ) =I(M 1 ;M 2 )+I(M 1 ;Z n |M 2 ) 

== I(M i; Z"|M 2 ) < r n , (34) 

where (a) follows because Mi and M 2 are independent. 
The previous equation shows that the leakage of Mi to the 
eavesdropper when M 2 is revealed to it is still small. 

4. On the other hand, the individual secrecy criterion is 
based on the mutual tmst between the legitimate receivers. 
Thus if one of the messages is compromised, this might also 
affects the secrecy of the other one. In order to understand 
this property, imagine that in the previous two examples, M 2 
was revealed to the eavesdropper as follows: 

I(Mi;Z"M 2 ) =H(Mi)-H(Mi|Z n M 2 ). (35) 

In the first scenario, where the eavesdropper Z is less noisy 
than the two legitimate receivers, the term H(Mi|Z”M 2 ) will 
vanish. This is because the eavesdropper can correctly decode 
M®, then using the secret key M 2 , it can extract Mi as well. 
This implies that Mi is fully leaked to the eavesdropper when 
M 2 is revealed to it. However, in the second scenario, the 
situation is a little bit different. This is because the term 
H(Mi|Z"M 2 ) does not vanish, yet it is smaller than H(Mi). 
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This means that a part of Mi is leaked to the eavesdropper up 
on revealing M 2 . The size of this part depends on how much 
the eavesdropper can infer using its received signal Z ra and 

M 2 . 

5. The preference in choosing among the two secrecy 
criteria is a trade of between conservative secrecy measure 
and a larger capacity region and the decision should always 
be based on whether the legitimate receivers can trust one 
another or not. 

IV. The Joint Secrecy Capacity Region 
I n this section, we investigate the joint secrecy criterion for 
the general model of the wiretap BC with degraded message 
sets and message cognition given by Figure 2. 

A. Achievable Rate Region 

Proposition 1. An achievable joint secrecy rate region for the 
wiretap BC with degraded message sets and message cognition 
is given by the set of all rate quadruples (f? c , Ro, Ri, f? 2 ) £ 
that satisfy 

R c < I(U; Z) 

Ro + Ri < I(V 0 Vi; Yi|U) - I(V 0 Vi; Z|U) 

Ro + Ri < I(V 0 V 2 ; Y 2 |U) - I(V 0 V 2 ; Z|U) 

R c + Ro + Ri < I(V 0 Vi; Y,) - I(V 0 V i; Z|U) 

R c + R 0 + R-2 < I(V 0 V 2 ; Y 2 ) - I(V 0 V 2 ; Z|U) 

2f? 0 + Ri + Ri < I(V 0 Vi; Yi|U) + I(V 0 V 2 ; Y 2 |U) 
-I(V i; V 2 |Vo)-I(V 0 V 1 V 2 ; Z|U) - I(V 0 ; Z|U) 
R c + 2R 0 + R 1 + R 2 < I(V 0 Vi; Y,) + I(V 0 V 2 ; Y 2 |U) 
-I(Vi; V 2 |Vo)-I(V 0 V 1 V 2 ; Z|U) - I(V 0 ; Z|U) 
R c + 2R 0 + Ri + Ri < I(VoVi; Yr |U) + I(V 0 V 2 ; Y 2 ) 
-I(V i; V 2 |Vo)-I(V 0 V 1 V 2 ; Z|U) - I(V 0 ; Z|U) 

(36) 

for random variables with joint probability distribution Q{u) 
(3(u 0 |w) Q(fi,u 2 |uo) Q(x\ v\,vf) Q(yi,y 2 ,z\x), such that 
U — Vo — (Vi,V 2 ) — X — (Yi,Y 2 ,Z) forms a Markov chain. 

Proof: The proof combines the principle of superposition 
random coding [15] in addition to the usage of Marton coding 
for secrecy as in [20], where strong secrecy is achieved as in 
[34-36], 

1. Message sets: We consider the following sets: The set 
of common messages Ml c = [1, 2 nRc \, the set of confidential 
common messages A4 0 = [l,2 ni?0 ], two sets of confidential 
individual messages Ml\ = [l, 2 " fll ] and MI 2 = [l,2” fl2 ], 
three sets of randomization messages for secrecy Ml r = 
[l, 2 nfl i, M ri = [1, 2 nRr iJ and M r2 = [1,2^2], finally 
two additional sets Mt ± = [l, 2 nii ‘i] and Mt 2 = [l,2” fl, 2] 
needed for the construction of Marton coding. Additionally 
we use M = ^ 40 X^ 11 X ^42 to abbreviate the set of all 
confidential messages. 

2. Random Codebook Cfy. Fix an input distribution 

Q(u,vo,v\,V 2 ,x). Construct the codewords u n {m c ) for 


m c £ A4 C by generating symbols Ui{m c ) with i £ [l,n] 
independently according to Q(u). For every u n {m c ), generate 
codewords vjj (m c , m, m r ) for m £ M and m r £ Ai r by 
generating symbols vo i (m c ,m, m r ) independently at random 
according to Q(vo\ui(m c )). Next, for each Vq (m c ,m,m r ) 
generate the codewords Vi(rn c , m, m r , m ri , ) and 

v 2 {m, c ,m,m r ,m r2 ,mt 2 ) for m ri £ A4 ri , m r2 £ A4 r2 , 
m tl £ M tl and m t2 £ M t2 by generating symbols 
v\ i (m c ,m,m r ,rn ri ,mt 1 ) and V 2 i (rn c ,m,m r ,m r2 ,mt 2 ) 
independently at random according to (5(ui|t)o ; (m c , to, ?n r )) 
and Q(v 2 \vo i (to c , to, m r )) respectively. 

3. Encoder E : Given a message pair (to c ,to), where 
to = (m.o,mi,m 2 ), the transmitter chooses three random¬ 
ization messages m r , m ri and m r2 uniformly at random 
from the sets A4 r , Ml r and Ml T2 respectively. Then, it 
finds a pair (mt 1 ,rrit 2 ) such that Vi(m c ,m,m r ,m ri ,mt 1 ) 
and v 2 ( to c , to , m r ,m r 2 ,m t2 ) are jointly typical. Finally, it 
generates a codeword x n independently at random according 
to nili Q( x i\ v iii v 2 i) an d transmits it. 

4. First Legitimate Decoder ipi: Given yj and its 

own message m 2 , outputs (to c ,Too,TOi, rh r )\ if they are 
the unique messages, such that u n (rh c ), VQ(tJi c ,rh,m r ), 
v™ (fh c , to, TO r , TO ri , 'fht 1 ) and y " are jointly typical, for 
some (m ri ,m tl ) £ Ml ri x Ml tl , where to = (to 0 ,TOi,to 2 ). 

Otherwise declares an error. 

5. Second Legitimate Decoder <p 2 : Given y 2 and its 

own message mi, outputs (to c , Too,to 2 , TO r ); if they are 
the unique messages, such that u n (m c ), vjj(m c ,m,m r ), 
v 2 (m c ,m,rh r ,rh r2 ,rht 2 ) and y 2 are jointly typical, for some 
(■ m r2 ,fh t2 ) £ Ml r2 x A4 t2 , where to = (to 0 ,toi,to 2 ). 

Otherwise declares an error. 

6. Third Eavesdropper Decoder : Given z n , outputs 
to c ; if it is the unique message, such that u n (rh c ) and z n 
are jointly typical. Otherwise declares an error. 

7. Reliability Analysis: We define the average error prob¬ 
ability of this scheme as 

P e (C n ) = P[(M C ,M 0 ,Mi,M r ) ^ (Me,Mo,Mi,M r ) or 
(M c ,M 0 ,M 2 ,M r ) ^ (M c ,M 0 ,M 2 ,M r ) or M C ^M C ], 

We then observe that P e (C n ) > P e {C n ), cf. (3). Using the 
standard analysis of random coding we can prove that for a 
sufficiently large n, with high probability P e (C n ) < e n if 

R c < I(U; Z) — 5 n (e n ) 

R tl +Rt 2 >I(Vi;V 2 |V 0 ) + <y„(e n ) 
Ro+Ri+R r +R ri +Rti < I(VoVi; Yi|U) — 6 n (e n ) 
Ro+Ri+R r +Rr 2 A-Rt 2 < I(VoV 2 ; Y 2 |U) — S n (e n ) 
Rc+Ro+Ri+Rr+Rn+Rti ^ I(VoVi;Yi) — S n (c n ) 
R c +Ro+R2+R r -\-Rr 2 PRt 2 5 I(VoV 2 ; Y 2 ) — S n (e n ). (37) 

The validity of (37) follows from the product structure of 
the codebook, the full cognition of the individual messages at 
the legitimate receivers and the principle of indirect decoding 
used in [20]. In addition, the second constraint follows due 
to Marton coding technique, where the summation of R tl 
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and R t2 should be greater than I(Vi; V 2 |Vo) to guarantee the 
existence of a typical pair (vi,v%). 

8. Secrecy Analysis: Our secrecy analysis is based on 
different strong secrecy techniques as in [34-36], We start 
by identifying all the virtual channels that exist between the 
confidential messages and the eavesdropper. Based on the 
codebook structure, we can define four possible channels 
as follow: Qi : V 0 -> V(Z), Q 2 : V 0 x Vi -> V(Z), 

Q 3 : Vo x V 2 -l T(Z) and Q 4 : V 0 x Vi x V 2 V(Z). 

According to [35], in order to fulfill the joint strong secrecy 
criterion in (18), we need to make sure that the randomization 
rate in the input sequence to each of these virtual channels 
is at least equivalent to the mutual information between the 
channel input and the eavesdropper. Thus, for a sufficiently 
large n and the joint secrecy constraints given in (18) 

is with high probability smaller than r„, if 

Rr > I(V 0 ; Z|U) + S n (r n ) 

Rr + R ri + R tl > I(V 0 V i; Z|U) + 6 n (r n ) 

R r + R r2 + R t2 > I(V 0 V 2 ; Z|U) + 5 n {r n ) 

Rr + R ri + R r2 > I(V 0 ViV 2 ; Z|U) + S n {r n ). (38) 

If we combine Eq. (37) and Eq. (38) then apply the Fourier- 
Motzkin elimination procedure, followed by taking the limit 
as n —t 00 , which implies that S n (e n ) and S n (T n ) —> 0, we 
prove the achievability of any rate quadruple (R c , f? 0 , Ri, R 2 ) 
satisfying (36). ■ 


B. Secrecy Capacity For A Class of More Capable Channels 

Theorem 5. Consider a wiretap BC with degraded message 
sets and message cognition, where one of the legitimate 
receivers Y 4 is more capable than the eavesdropper Z, while 
the relation between the other legitimate receiver Y 2 and 
the eavesdropper Z is arbitrary. Then, the joint secrecy 
capacity region is given by the set of all rate quadruples 
( R Cl Ro, Rh R 2 ) € Mi that satisfy 

R c < I(U; Z) 

R 0 + Ri< I(X;Yi|U) -I(X;Z|U) 

R 0 + R 2 <I(V;Y 2 |U)-I(V;Z|U) 

R c + R 0 + Ri< I(X; Yi) - I(X; Z|U) 

R c + Ro + R 2 < I(V; Y 2 ) — I(V; Z|U) (39) 

for some (U, V, X), such that U — V — X — (Yi,Y 2 , Z) forms 
a Markov chain. Further it suffices to have \IA\ < \X\ +3 and 
\V\ < |Y| 2 +4|Y|+3. 

Proof: The achievability is based on the principle of 
indirect decoding introduced in [6] and its extension to secrecy 
scenarios discussed in [20]. It also follows directly from 
Proposition 1, by letting V 2 = 0, Vo = V and Vi = X in (36). 
This implies that the first legitimate receiver Y 1 which is more 
capable than the eavesdropper Z finds its intended messages by 
direct decoding from X, while the second legitimate receiver 
Y 2 which has no stastical advantage over the eavesdropper 
Z finds its intended messages by indirect decoding from the 
auxiliary random variable V. 


For the converse, we start by modifying the joint secrecy 
constraint in (18) to include the conditioning on the common 
message. For this we need the following lemma: 

Lemma 2. Consider two independent random variables M 
and W, such that H(W|Z”) < a and I(M; Z n ) < /3, where 
a,/3> 0. Then, I(M; Z n |W) < a + /3 holds. 

Proof: The proof is based on the properties of the entropy 
function and is given in Appendix B for completeness. ■ 

Since Eq. (6) implies that H(M C |Z") < n 7 c (e„) and Eq. 
(18) implies that I(MoM]M 2 ; Z”) < r n , we can use the 
previous lemma to reformulate the joint secrecy constraint for 
our scenario as: 


I(M 0 M 1 M 2 ; Z”|M c ) < nj c (e n ) + r n . (40) 


Now, we are ready to formulate our converse. First, we 
let U* = (M c ,Z i+1 ), K\ = Y}" 1 , K? = Yff 1 , M = 
(M 0 ,M!,M 2 ), V} 4 (M.Ui.Kj) and V? = (M, Uj,K?). We 
then start by considering the common rate R c , applying the 
same steps used in (9), we have 


R c < - I(Uj; Zj) + 7 c (e„). 

n L ^ 


(41) 


i=1 


Next, we consider the confidential rates ( Rq + Ri) intended 
for the first legitimate receiver. We have 

Ro + Ri < ^I(M 0 M i; Y”|M 2 M c ) + 7 i(e„) 

< ^I(M; Y”|M C )+7i(e n ) 

(b) 1 

< - 
n l 


I(M; Y"|M C ) — I(M; Z n |M c )J + 7l (e n ,r„) 

n 

[l(M; Y H |M C Y^ _1 ) — I(M; Z i |M c Z i+1 )" 


i= 1 


•7l (en,T n ) 


(c) 1 


ft 

Y ^I(M; Y li |M c Y^ 1 Z i+1 ) 


— I(M; ZJMeY^ - Z J+i )J + 7 i(e„,T„) 

n 

Y ^(VhYwIUiKj) -IfV^ZilUiKj) 

i= 1 

+ 71 (en,T n ), 


(42) 


where (a) follows from (7); (b) follows from (40), where 
7 i(en,T„) = T n /n + 7 C (e„) + 71 (e„) and (c) follows by 
the Csiszar sum identity [15, Lemma 7]. Following the same 
steps we can derive a similar bound for the confidential rates 
(Ro + R->) intended for the second legitimate receiver as: 

R 0 + R 2 < -Y kv^YalUiKfj-lCVj^ilUiK?) 

n A ' L J 

i=1 

+ 72 (e n ,T n ), (43) 


where 7 2 (e„, r„) = T„/n+7 c (e n )+7 2 (e n ). On the other hand, 
if we consider the sum of the common rate and the confidential 
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rates ( R c + Rq + Ri) intended for the first legitimate receiver, 
we have 

R c +R 0 + Ri < —I(M c M 0 M i; Y”|M 2 ) + 71 (e„) 
n 

< —I(M C M; Y”) + 71 (e n ) 
n 

(i.) i r i 

< - I(M C ; Y”) + I(M; Y"|M C ) — I(M; Z”|M C ) 

n L J 

+ 7 i(e„,r„) 

( c ) .j n 

< ~E ^(McZ^jYulYr^+^VhYulUiKj) 

1 i— 1 

— I(Vj; Z.j|U,;K,-)J +7i (e n ,T n ) 

n 

= E ^(UisYulKj) + I(V};Y li |U i Kj) 

2=1 

-^VjjZilUiKj)] +7i(£n,r„) 
n 

= E [l(Vj; YulKj) - I(VJ; Z^U.K, 1 )' 

2=1 

+ 7i(<7!,r„), (44) 

where (a) follows from ( 6 ) and (7) as 7 i(e n ) = 7 c (e„) + 
7 i(en); (b) follows from (40), where 7 i(e n ,r„) = r„/n + 
27 C (cn) + 7i(e n ); (c) follows as in (42) and the fact that 
I(M c Z i+ 1 ;Yi i |Yi“ 1 ) > I(M c ;Yi i |Yi“ 1 ); while (d) follows 
from the chain rule of mutual information. Following the same 
steps we can derive a similar bound for the sum of the common 
rate and the confidential rates ( R c + Rq + R 2 ) intended for 
the second legitimate receiver as 

n 

R c + R 0 + f ?2 < E [“(V?; Y 2 *l K i) - E (V?; ZilUiK?) 

2 = 1 

+ 72 (e„,r n ), (45) 

where 7 2 (e„,r„) = T n /n + 2y c (e n ) +7 2 (e„). Now using (41) 
- (45) followed by introducing a random variable T indepen¬ 
dent of all others and uniformly distributed over [ 1 ; n] and 
let U = (U T , T), K 1 = K^, K 2 = K 2 , V 1 = V|, V 2 = V|, 
Yj = Yjt, Y 2 = Y 2T and Z = Z T , then take the limit as 
u ->00 such that 7 c (e n ), 7 i(e„,r n ), ii(e n ,T n ), 7 2 (e„,r„) 
and 72 (e n , r n ) —>• 0 , we reach the following 

i? c < I(U; Z) (46a) 

R 0 + R 1 < I(V 1 ; Y 1 IUK 1 ) — ICV 1 ; ZfUK 1 ) (46b) 

Ro + R 2 < I(V 2 ; Y 2 |UK 2 ) - I(V 2 ; Z|UK 2 ) (46c) 

R c + R 0 + R 1 < I(V 1 ; YijK 1 ) — I(V 1 ; ZIUK 1 ) (46d) 

R c + R 0 + R 2 <I(V 2 ;Y 2 |K 2 )-I(V 2 ;Z|UK 2 ), (46e) 

where (U, K 1 ) - V 1 - X - (Yi, Y 2 , Z) and (U,K 2 )-V 2 - 
X— (Yi,Y 2 ,Z) form Markov chains. First, let us consider 
(46c) and (46e), these two inequalities identify the constraints 
on the common and confidential rates with respect to the 
second legitimate receiver, which have an arbitrary relation 
with the eavesdropper. Since conditional mutual information 
is the expectation of the unconditional one, Eq. (46c) can be 


upper bounded as follows: 

R 0 + R 2 < E K 2 [l(V 2 ; Y 2 |U, K 2 )-I(V 2 ; Z|U, K 2 ) 

< I(V 2 ; Y 2 |U, K 2 =k 2 *) - I(V 2 ; Z|U, K 2 =k 2 *) 

( = } I(V 2 *;Y 2 |U)-I(V 2 *;Z|U), (47) 

where U — V 2 * — X — (Yi, Y 2 , Z) forms a Markov chain, 
(a) follows because k 2 * is the value of K 2 such that, 
I(V 2 ;Y 2 |U,K 2 =k 2 *) — I(V 2 ;Z|U,K 2 =k 2 *) is greater than 
or equal I(V 2 ; Y 2 |U,K 2 =k 2 ) - I(V 2 ;Z|U,K 2 =k 2 ), for all 
k 2 € while ( b ) follows as V 2 * is distributed as 

Q(v 2 \u,k 2 = k 2 *). Similarly we can bound Eq. (46e) as 
follows: 

R c + R 0 + R 2 < E K 2 [l(V 2 ; Y 2 |K 2 )-I(V 2 ; Z|U, K 2 ) 

< I(V 2 ; Y 2 |K 2 =fc 2 *)-I(V 2 ;Z|U,K 2 =k 2 *) 

= I(V 2 *; Y 2 ) — I(V 2 *; Z|U) 

= H(U; Y 2 ) + I(V 2 *; Y 2 |U) - H(V 2 *; Z|U) 

(d) „ 

< I(U; Y 2 ) + I(V 2 *; Y 2 |U) — I(V 2 *; Z|U) 

= I(V 2 *; Y 2 ) — I(V 2 *; Z|U), (48) 

where (a) follows as k 2 * is the value of K 2 such that, 
I(V 2 ;Y 2 |K 2 =k 2 *) — I(V 2 ;Z|U,K 2 =k 2 *) is greater than or 
equal toI(V 2 ;Y 2 |K 2 =fc 2 )— I(V 2 ; Z|U, K 2 =k 2 ), for all k 2 G 
K?\ ( b ) follows as V 2 * is distributed as Q(v 2 \u, k 2 = k 2 *)\ 
(c) follows because U — V 2 * — X — (Y l5 Y 2 , Z) forms 
a Markov chain; and (d) follows because the term 
I(V 2 *; Y 2 |U) — I(V 2 *; Z|U) can be reformulated as 
I(V 2 ;Y 2 |U,K 2 =k 2 *) - I(V 2 ; Z|U,K 2 =k 2 *) which is 
smaller than or equal to I(V 2 *; Y 2 |U) — I(V 2 *; Z|U). This 
actually implies that k 2 * and A: 2 * are identical and the 
differences of the mutual information condition on K 2 in 
(46c) and (46e) are maximized by the same value. 

Now, consider (46b) and (46d), these two inequalities 
identify the constraints on the common and confidential rates 
with respect to the first legitimate receiver which is more 
capable than the eavesdropper. In order to simplify these two 
inequalities we require the following lemma. 

Lemma 3. Let Q(y,z\x) be a discrete memoryless BC 
and assume that Y is more capable than Z. Consider K, 
U 1 , U 2 and V to be a set of random variables, such 
that (U 1 , U 2 , K) — V — X — (Y, Z) forms a Markov chain. 
Then the following holds: I(V; Y|U 1 K) — I(V; Z|U 2 K) < 
IKXjYIU 1 ) -I(X;Z|U 2 ). 

Proof: This lemma is based on the properties of more 
capable channels and the definition of the conditional mutual 
information. A detailed proof is given in Appendix C for 
completeness. ■ 

If we apply the previous lemma to Eq. (46b) by letting 
U 1 = U 2 = U, we have 


Ro + Ri < I(X; Yi |U) - I(X; Z|U). 


(49) 
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On the other hand if we let U 1 = 0 and U 2 = U, then applied 
the previous lemma to Eq. (46d), we reach the following bound 

R c + R 0 + Ri <I(X;Y!) —I(X;Z|U). (50) 

Now, if we combine the upper bounds in (46a), (47) - (50), 
then let V = V 2 *, such that U — V — X — (Yi, Y 2 , Z) forms 
a Markov chain, we reach a region that matches the achievable 
rate region given by (39) and this completes our converse. One 
last point remains, regarding the cardinality bounds on \U\ and 
| V |, they follow from the Fenchel-Bunt strengthening of the 
usual Caratheodory’s theorem [31, Appendix C], ■ 

Corollary 1. Consider a wiretap BC with degraded message 
sets and message cognition where the two legitimate receivers 
Yi and Y 2 are less noisy than the eavesdropper Z, i.e. Yi A Z 
and Y 2 A Z. Then, the joint secrecy capacity region is given 
by the set of all rate quadruples {R Cl Ro, Ri, R 2 ) G that 
satisfy 

R c < I(U; Z) 

R 0 + Ri < I(X; Yi |U) - I(X; Z|U) 
i?o + i? 2 <I(X;Y 2 |U)-I(X;Z|U) 

for some (U,X), such that U — X — (Yi, Y 2 , Z) forms a 
Markov chain. Further it suffices to have |U| < |X| + 3. 

Proof: The achievability of the previous region follows as 
in Theorem 5 by substituting V = X, while the converse can 
be derived using the standard techniques of less noisy channels 
as in [20], The previous region was first established in [2], ■ 

Corollary 2. Consider a wiretap BC with message cognition 
only where the two legitimate receivers Y| and Y 2 are more 
capable than the eavesdropper Z. Then, the joint secrecy 
capacity region is given by the set of all rate pairs (R\, R 2 ) G 
R 2 that satisfy 

i?i <I(X;Yi)-I(X;Z) 

Ri <I(X;Y 2 )-I(X;Z) 

Proof: The achievability of the previous region follows 
as in Theorem 5 by substituting V = X and U = 0, while the 
converse follows by adapting the more capable condition to 
the second legitimate receiver Y 2 . The previous region was 
first established in [1], ■ 

V. The Individual Secrecy Capacity Region 

In this section, we investigate the model of the wiretap BC 
with degraded message sets and message cognition given by 
Figure 2 under the individual secrecy constraint. 

A. Achievable Rate Region 

Proposition 2. An achievable individual secrecy rate region 
for the wiretap BC with degraded message sets and mes¬ 
sage cognition is given by the set of all rate quadruples 


(R c , Ro, Ri = Rn +R 12 , R -2 = -R 21 +-R 22 ) G R+ that satisfy 
R c < min [l(U; Z), I(U; Yi), I(U; Y 2 ) 

R 12 = R 21 < min [i? 1 ,fi 2 ,I(V 0 ;Y 1 |U),I(V 0 ;Y 2 |U) 
Ro+Rn < ^VoV^YrlV®) -I(V o Vi;Z|V 0 ) 
R 0 +R 22 < I(V O V 2 ;Y 2 |V 0 ) -I(V O V 2 ;Z|V 0 ) 
2R 0 +R 11 +R 22 < I(V 0 V i; Yr|V 0 ) + I(V 0 V 2 ; Y 2 |V 0 ) 

—I(V i; V 2 |V 0 )—I(V o ViV 2 ;Z|V 0 ) -I(V O ;Z|V 0 ) (51) 

for random variables with joint probability distribution Q(u) 
Q(v®\u) Q(u o |u 0 ) Q(vi,v 2 \v 0 ) Q(x\vuv 2 ) Q(yi,y 2 ,z\x), 
such that U — V 0 — Vo — (Vi, V 2 ) — X — (Yi, Y 2 , Z) forms 
a Markov chain. 

Proof: The proof combines the principle of superposition 
random coding [15], one time pad for Shannon’s cipher system 
[13], the usage of Marton coding for secrecy as in [20], where 
strong secrecy is achieved as in [34-36]. 

1. Message sets: We consider the following sets: The set of 
common messages M c = [1, 2 ni?< ], the set of confidential 
common messages Mo = [1,2"^°], two sets of confidential 
individual messages M\ = [l,2 rai?1 ] and M 2 = [l,2 nJ?2 ], 
three sets of randomization messages for secrecy M r = 
[1, 2 nRr \, M ri = [1,2”^!] and M r2 = [1, 2 nR - 2 \, finally 
two additional sets M tl = [l,2" fl *i] and Mt 2 = [l, 2 nii * 2 ] 
needed for the construction of Marton coding. Further we 
divided each confidential individual messages set into two sets 
as follows: M\ = M nX M.\ 2 and M 2 = A4 2 ixA4 22 , where 
M n = [1,2"«“], M 12 = [1,2"- Rl2 ], M 21 = {l,2 nR ^j 
and M 22 = [l,2 nfl22 ]. In this division, we force A4 i 2 
and M>\ to be of the same size and use them to construct 
7^0 — [l,2 rafl ®] by Xoring the corresponding elements of 
both. Additionally we use M = Mo x M\\ x M 22 x A4 0 
to abbreviate the modified set of all confidential messages. 
It is important to note that the message structure forces the 
following condition: 

i? 0 = R\ 2 = R 2 \ < min [i?i,i? 2 ] (52) 

2. Random Codebook C s n : Fix an input distribution 

Q(u,v<gi,Vo,Vi,v 2 ,x). Construct the codewords u n (m c ) for 
m c G M c by generating symbols Ui(m c ) with i G [l,n] 
independently according to Q(u). For every u n (m c ), generate 
codewords u 0 (?n c ,TO 0 ) for m 0 G A4 0 by generating 
symbols u 0i (m c ,m 0 ) independently at random according 
to Q(v®\ui(m c )). Next, for every v®(m c , m 0 ) generate 
codewords vjj(m c ,m,m r ) for m G M and m r G M r by 
generating symbols vo i (m c ,m,m r ) independently at random 
according to <3(uo|w 0i (m c ,m 0 )). For each Vq (m c ,m,m r ) 
generate the codewords u”(m c ,m, m r ,m ri , rritf) and 
v 2 {m c ,m,m r ,m r2 ,m t2 ) for m ri G M ri , m r2 G M r2 , 
m tl G M tl and rn t2 G M t2 by generating symbols 
Vi i {m c ,m,m r ,m ri ,mt 1 ) and v 2i (m c ,m,m r ,m r2 ,mt 2 ) 
independently at random according to Q{vi\vo i (vn c , to, m r )) 
and Q(y 2 1u 7 o i {jn c , m, 7?i r )) respectively. 

3. Encoder E: Given a message pair (m c ,m), where 
in = (mo,TOii,m 22 ,m 0 ) and to 0 = mi 2 ® m 2 1 , the 
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transmitter chooses three randomization messages m r , m ri 
and m r2 uniformly at random from the sets A4 r , A4 ri and 
A i r2 respectively. Then, it finds a pair ( m tl ,m t2 ) such that 
v?(m c ,m,m r ,m ri ,m tl ) and v%(m c ,m,m r ,m r2 ,mt 2 ) are 
jointly typical. Finally, it generates a codeword x n inde¬ 
pendently at random according to JX ” =1 Q( X %\ V U> v 2 i) and 
transmits it. 

4. First Legitimate Decoder p\: Given if and its own 

message m 2 = ( 77 x 21 , 77122 ), outputs (m c ,rho,ihi,m r )', where 
77 t 1 is the concatenation of 777,11 and 777,12. First it finds 
the unique messages (t7x c , ttx® , m, m r ) such that u n (m c ), 
v®(m c ,rh®), Vo(m c ,m,m r ), v™{m c ,m,m r ,m ri ,m tl ) and 
y[ l are jointly typical, for some (m ri ,m tl ) G AT ri x A4 tl , 
where m = (77x0,77111,77x22,77x0). Then, it computes 777,12 by 
Xoring 77 x 21 and rh, 0 . Otherwise it declares an error. 

5. Second legitimate Decoder ip 2 : Given ?y 2 and its own 

message 777,1 = ( 77 x 11 , 77 x 12 ), outputs (?tx c , ttxo, 77 x 2 ,77x r ); where 
777,2 is the concatenation of 777,21 and 777,22- First it finds 
the unique messages ( m c , fh ®, m , m r ) such that u n (m c ), 
(77X0,771®), VQ ( m c , m , m r ), v %( m c , m , m r , rh r 2 , m t2 ) and 
7/2 are jointly typical, for some (m r2 ,m t2 ) € M r2 x A it 2 , 
where rh = (7710,77x11,77x22,77x0). Then, it computes 77x21 by 
Xoring 77 x 12 and 777,0 . Otherwise it declares an error. 

6. Third Eavesdropper Decoder ip 3 : Given z n , outputs 
? 7 x c ; if it is the unique message, such that u n ( rh c ) and z n 
are jointly typical. Otherwise it declares an error. 

7. Reliability Analysis: We define the error probability of 
this scheme as 

Pe(Cn) = P[(M c ,M 0 ,Mo,Mn,M,,) f (M c ,M 0 ,M 0 ,M n , 
M r ) or (M c ,M0,M o ,M 22 ,M,) f (M C ,M 0 , 
M 0 ,M 22 ,M r ) or M C ^M C ], 


The term I(Mi 2 ; Z n |MoMn) represents the leakage of Mi 2 
to the eavesdropper given Mo and Mu. One can proof that 
this term vanishes as 

I(M 12 ; Z n |M 0 Mn) = H(M 12 |M 0 M n ) - H(M 12 |Z n M 0 M 11 ) 

= H(Mi 2 ) - H(Mi 2 |Z n M 0 M n ) 

iP) (c) 

< H(M 12 ) - H(Mia|M 0 ) = 0, (55) 

where (a) follows because M 12 , Mo and Mu are independent; 
( b ) follows because the best the eavesdropper can do is to 
decode M 8 ; while (c) follows because of the principle of 
one time pad in Shannon’s cipher system where the entropy 
of the secret key H(M 2 i) is equal to the entropy of the 
transmitted message H(Mi 2 ). Using the same steps, we can 
prove that the term I(M 21 ; Z ,! jM 0 M 22 ) which represents the 
leakage of M 21 to the eavesdropper given M 0 and M 22 also 
vanishes. On the other hand, for a sufficiently large n and 
T n > max(ri„,T 2 „) > 0, the terms I(MoMn;Z") and 
I(MoM 2 2 ; Z") are with high probability smaller than r„, if 

Rr > I(V 0 ; Z|V 0 ) + 5 n [r n ) 

R r + R ri + Rt 1 > I(VoVi; ZIV 0 ) + S n (T n ) 

R r + R r2 + R t2 > I(VoV2; ZIV 0 ) + 8 n (r n ) 

Rr + R ri + Rr 2 > I(V 0 ViV 2 ; Z|V 0 ) + 8 n (r n ). (56) 

This follows from applying the strong secrecy approach in 
[35] to the codebook structure of the individual secrecy as we 
did for the joint secrecy in the previous section. This implies 
that under the previous constraints, the leakage terms in (54) 
are with high probability smaller than r n . 

Now, if we combine (52), (53) and (56), then take the limit 
as 7 i —► 00 , which implies that S n (e n ) and 8 n (r n ) —3 0 , we 
prove the achievability of any rate quadruple (f? c , Ro. R \. II 2 ) 
satisfying (51). ■ 


We then observe that P e (C n ) > P e {C n ), cf. (3). Using the 
standard analysis of random coding we can prove that for a 
sufficiently large ?x, with high probability P e (C n ) < e n if 


R c < min 
Rtx, < min 


H(U; Y 1 ),I(U; Y 2 ),I(U; Z) 
|l(V 0 ;Y 1 |U),I(V 0 ;Y 2 |U) 


^n(^n) 
8n (^n) 


Rti + Rt 2 > I(Vi; V 2 |Vo) + 8 n (e n ) 

Ro + R11 + Rr + Rri + Rt x < I(V 0 Vi; Y1IV0) — 5 n (e n ) 

Ro + R22 + Rr + Rr 2 + Rto < I(V 0 V2; Y2IV0) — 5 n (e n ). 

(53) 


8 . Secrecy Analysis: Because of the new message sets 
structure, the random variable Mj is identified as the product 
of two independent and uniformly distributed random variables 
Mu and M 12 . This also applies to M 2 which is the product of 
two independent and uniformly distributed random variables 
M 21 and M 22 - Thus, the individual secrecy constraint given 
by (19) becomes 


I(MoMn; Z n ) + I(Mi 2 ; Z n |MoMn) < ti„ 
I(M 0 M 22 ; Z") + I(M 2 i; Z"|M 0 M 22 ) < r 2n . (54) 


B. Secrecy Capacity For A Class of More Capable Channels 
Theorem 6. Consider a wiretap BC with degraded message 
sets and message cognition, where the two legitimate receivers 
Yi and Y 2 are more capable than the eavesdropper Z. Then, 
the individual secrecy capacity region is given by the set of 
all rate quadruples (R Cl Rq, R\, R 2 ) G R% that satisfy 

R c < I(U; Z) 

R 0 + R 1 <I(X;Yi|U)-I(X;Z|U) + i2® 
f ? 0 + i ? 2 < I(X; Y 2 |U) - I(X; Z|U) + i ?0 
Rc + Ro + Ri < I(X; Yi) - I(X; Z|U) + R® 

R c + R 0 + R 2 < I(X; Y 2 ) - I(X; Z|U) + R# (57) 


where R® = min |^i?i, R- 2 , 1(X; Z|U)J, for some (U, X), such 
that U X - (Yi,Y 2 ,Z) forms a Markov chain. Further it 
suffices to have \U\ < \X\ + 2. 


Proof: The achievability is based on the same principle 
used in Proposition 2. We start by modifying the structure 
of the random codebook as follows; For every u n (m c ), we 
generate the codewords x n (m c ,m.,m r ) by generating sym¬ 
bols Xi{yn c , ttx , 777 r ) independently at random according to 
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Q(x\ui(m c )). Given a message pair (m c ,m), the encoder 
chooses a message m r uniformly at random from the set A4 r 
and transmits x n (m c ,m,m r ). This changes the decoder at 
the first legitimate receiver such that, it outputs (m c ,m,m r ), 
if it is the unique triple, where u n (rh c ), x n (m c ,m,rh r ) and 
y” are jointly typical. The decoder at the second legitimate 
receiver also changes in the same way, while the decoder as the 
eavesdropper is kept unchanged. Under these modifications, 
the reliability conditions in (53) changes to: 

R c < I(U; Z) — 6 n (e n ) 

Ro + R\i + R® + Rr < I(X; Yi|U) — S n (e n ) 

Ro + R22 + R® + Rr < E(X; Y2 1 U) — S n (e n ) 

Rc + Ro + R11 + R® + Rr < E(X; Yj) — S n (e n ) 

Rc + Ro + R22 + R® + R r < I(X; Y 2 ) — S n (e n ). (58) 

On the other hand, the secrecy conditions in (56) simplifies to 
R® + Rr > I(X; Z|U) + 5 n (r n ). (59) 

Now using Fourier-Motzkin elimination on the rate constraints 
given in (52), (58) and (59) followed by taking the limit as 
n —> 00 , which implies that S n (e n ) and —> 0, leads the 

achievability of any rate quadruple (R c , Ro, Ri, R2) satisfying 
(57). 

Before jumping to the converse, it is important to highlight 
the difference between the coding structure in Proposition 2 
and in this theorem. In this theorem, the two secrecy encoding 
techniques: one time pad secret key encoding and wiretap 
random coding were combined in the same layer X. On the 
other hand, in Proposition 2 they were structured into two 
different layers. In the first layer V® was used for the one 
time pad secret key encoding, while the wiretap random coding 
was performed in the next layers using Vo, Vi and V 2 . This 
is because combining the two techniques in the same layer is 
only possible, if the two legitimate receivers have a statistical 
advantage over the eavesdropper, such that I(X;Yi) and 
I(X;Y 2 ) are greater than I(X;Z). Otherwise, the conditions 
in (58) and (59) can not be fulfilled simultaneously leading to 
a decoding failure. 

Now for the converse, we start by letting U, = (M c , Z* +1 ), 
K 1 = Yj" 1 , K 2 4 Yj" 1 , M = (M 0 , M 1; M 2 ), V 1 4 
(M, U.jjK 1 ) and V 2 = (M,Uj,K 2 ). Using the same steps 
carried out in (9), we have 

1 n 

i?c<-Vl(U ? ;Z t )+ 7c (6 n ). (60) 

n 

t—i 

Next, let us consider the confidential rates {Rq + Ri) intended 
to the first legitimate receiver, we have 

R0 + R1 < ^I(M 0 M i; Y”|M 2 M C ) + 71 (e„) 

< —I(M; Y"|M C ) + 7r(e n ) 

n 

(b) l r 

< - I(M;Y”|M C )-max [l(M 0 Mi;Z”|M c ), 

I(M 0 M 2 ;Z"|M c )] +7i(e n ,r n ) 

= 1 fl(M;Yj|M c )-I(M;Z n |M c )l +71 (e n ,T n ) 
n L J 


+ - min Z"|M 0 M 2 M C ), I(M 2 ; Z”|M 0 MiM c ) 

n L 

(c) 1 r 1 

< -[l(M;Y"|M c ) -I(M;Z"|M C )J +mm[R 1 ,R 2 ] 

+ 7l( £ n, T n ) 

1 n 

( = } -Y, [ijVhYulUiKjj-IjVjjZilUiKj) 
i —1 

+ min [i?i,i? 2 ] + 7 i(e n ,r n ), (61) 

where (a) follows from (7); (b) follows after modifying the 
individual secrecy conditions in (19) to include the condition¬ 
ing on the common message M c based on (6) and Lemma 2; 
(c) follows because of the fact that Ri > I(Mi; Z”|MoM 2 M c ) 
and i? 2 > I(M 2 ; Z”|MoMiM c ); and (d) follows as in (42). 
Following the same steps we can derive a similar bound for the 
confidential rates (i?o +R 2 ) intended to the second legitimate 
receiver as: 

1 n 

Ro + R 2 < ~ V [l(V?; Y 2i |U<K?) - I(V?; ZilUiK?) 

i—l 

+ min [i?i,i? 2 ] + 7 2 (e n ,r n ). (62) 

Now, consider the sum of the common rate and the confidential 
rates to the first and the second legitimate receivers. Using the 
techniques used in (61) and (44), we can derive the following 
bounds 

1 n 

R c + Ro + Ri<-V] [ijV 1 ; Yu|Kj) - IjV 1 ; Z^N 1 ) 

x=i 

+ min [-^ 1 ,^ 2 ] +7l( e n,^n) 

1 n 

Rc + Ro + R 2 < - y, [l(V?; Y 2 i|K?) - I(Vf; Z,|U,Kf) 

i=l 

+ min [i?i,i? 2 ] + 7 2 (e ra ,r n ). (63) 

Now using (60), (61), (62) and (63), followed by introducing 
a random variable T independent of all others and uni¬ 
formly distributed over [1; n] and let U = (Ut, T), K 1 = Kj,, 
K 2 = K 2 ,, V 1 = V^, V 2 = V 2 , Yi = Y 1T , Y 2 = Y 2T and 
Z = Zt, then take the limit as n —> 00 such that 7 c (e„), 
7i(en,r„), 7i(e„,T„), 7 2 (e„,r„) and 7 2 (e n ,r n ) 0, we 

reach the following 

R c < I(U; Z) 

R 0 +R 1 < IjV 1 ; YijUK 1 )—IjV 1 ; Z|UK 1 )+min [i?i,i? 2 ] 
R 0 +R 2 < I(V 2 ;Y 2 |UK 2 )-I(V 2 ;Z|UK 2 )+min [i?i,i?. 2 ] 
R c +Ro+Ri < IjV 1 ; YijK 1 )—IjV 1 ; Z|UK 1 )+min 
R c +R 0 +R 2 < I(V 2 ; Y 2 |K 2 )—I(V 2 ; Z|UK 2 )+min [R^Rn] . 

Since Yj and Y 2 are more capable than Z, we can use 
Lemma 3 to modify the previous bounds as we did in 
modifying the bounds in (46b) and (46d) to (49) and (50) 
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as follows: 

R c < I(U; Z) 

Ro + Ri < I(X; Yi |U) - I(X; Z|U) + min [R u R 2 ] 

R 0 + R 2 < I(X; Y 2 |U) — I(X; Z|U) + min [R u R 2 ] 
R c +Rq+R i < I(X; Yi) - I(X; Z|U) + min [R u R 2 \ 
R c +R 0 +R 2 < I(X; Y 2 ) - I(X; Z|U) + min [R lt R 2 \ . (64) 

To finalize our converse, we need to highlight the upper bounds 
required for reliable communication established in (14) and 
(15) in addition to the standard tipper bound in (16). These 
bounds will impose and additional constraint to guarantee 
that the addition of the minimum of R\ and R 2 does not 
contradict them. Thus the term min[i?i,i? 2 ] will change to 
min[i?i, f? 2 ,1(X; Z|U)]. Introducing this modification to the 
bounds in (64) matches the rate region in (57) and this 
completes our converse. ■ 

Corollary 3. Consider a wiretap BC with degraded message 
sets and message cognition where the two legitimate receivers 
Yi and Y 2 are less noisy than the eavesdropper Z, i.e. Yi ^ Z 
and Y 2 Z. Then, the individual secrecy capacity region is 
given by the set of all rate quadruples ( R c , i? 0 , Ri, R 2 ) G R+ 
that satisfy 

R c < I(U; Z) 

Ro+Ri <I(X;Yi|U)-I(X;Z|U)+min R u R 2 , 1(X; Z|U) 

R 0 +R 2 < I(X;Y 2 |U)-I(X;Z|U)+min \r u R 2 , I(X; Z|U) 

for some (U,X), such that U — X — (Yi, Y 2 , Z) forms a 
Markov chain. Further it suffices to have |U| < |X| + 3. 

Proof: The previous region is a special case from the 
region in Theorem 2, where the sum rate bound is not needed 
because of the properties of less noisy channels. The previous 
region was first established in [2], ■ 

VI. Conclusion 

We studied a three-receiver broadcast channel with degraded 
message sets and message cognition. We established the non¬ 
secrecy capacity region for the general case by providing a 
weak converse showing that the straightforward extension of 
the Korner and Marton bound to our model is optimal. We 
then investigated, evaluated and compared the performance 
of two different secrecy constraints for our model: the joint 
secrecy and the individual one. For each constraint we derived 
a general achievable rate region. We further showed that the 
principle of indirect decoding is optimal for the joint secrecy 
criterion, if only one of the legitimate receivers is more capable 
than the eavesdropper, such that it establishes the capacity. 
On the other hand, we managed to establish the individual 
secrecy capacity if the two receivers are more capable than the 
eavesdropper. Our results indicate that the individual secrecy 
provides a larger capacity region as compared to the joint 
one. This increase arises from the mutual trust between the 
legitimate receivers in the individual secrecy constraint that 
allows the usage of secret key encoding, which is not possible 
for the conservative joint secrecy. 


Appendix 

A. Proof of Lemma 1 

Proof: We define A = |[I(M;Z"|W) - I(M;Y n |W)] 
and prove that if Y >; Z, A < 0 and this directly implies our 
proposition. Let U* = (W, Z ,;+1 , Y i_1 ) and Vi = (M,Ui), 
we have 

1 n 

A = - ^ [l( M ; ZjWZ i+1 ) - I(M; YJWY* -1 ) 

U i =1 

1 n 

= - [l(M; ZJWZ^Y*- 1 ) - I(\I:Y ( WZ' ^Y' ') 

n i=i J 

1 n 

= - V [l(Vj; Zj|Uj) — I(Vj; Yj|Ui) 

n L J 

i =1 

= I(V; Z|U) — I(V; Y|U) 

= Eu[l(V;Z|U)-I(V;Y|U) 

(c) 

< I(V; Z|U = u*) — I(V; Y|U = u*) 

(d ) (e) 

< I(V*;Z) -I(V*;Y) < 0 (65) 

where (a) follows from the Csiszar sum identity [15, Lemma 
7]; (6) follows by introducing a random variable T indepen¬ 
dent of all others and uniformly distributed over [l,n], then 
letting U=(U t ,T), V = V r , Y = Y t and Z = Z T ; (c) 
follows as u* is the value of U that maximizes the difference; 
( d ) follows as V* is distributed as Q(v\u = u*) cf. [11, 
Corollary 2.3] and (e) follows since V* — X — (Y, Z) forms 
a Markov chain and Y y Z. ■ 

B. Proof of Lemma 2 

Proof: We have 

I(M; Z n |W) = H(M|W) - H(M|Z"W) 

< H(M|W) - H(M|Z"W) - H(W|Z n ) + a 

== H(M) — H(WM|Z n ) + a 

= H(M) - H(M|Z") - H(W|Z n M) + a 

(b) 

< I(M; Z n ) + a < a + 

where (a) follows because M and W are independent, while 
(h) follows because H(W|Z”M) >0. ■ 

C. Proof of Lemma 3 

Proof: Let 0 = I(V; Y^K) - I(V; Z|U 2 K), we have 
0 = E k |"l(V; YIU 1 , K) — I(V; Z|U 2 , K) 

(a) 

< I(V; YIU 1 , K =k*) - I(V; Z|U 2 , K =k *) 

= I(V*; YjU 1 ) — I(V*; Z|U 2 ) 

= I(X; YIU 1 ) - I(X; Y|V*) - I(X; Z|U 2 ) + I(X; Z|V*) 

(d) 

< ^XjYIU 1 ) -I(X;Z|U 2 ), 
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where (a) follows as k* is the value of K that maximizes the 
difference; ( b ) follows as V* is distributed as Q(v\ur ,u 2 ,k = 
k*)\ (c) follows since (U 1 , U 2 ) — V* — X — (Y, Z) forms a 
Markov chain and (d) follows because Y is more capable 
than Z, which implies that I(X; Y|V*) > I(X; Z|V*). ■ 
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